Big issue with account assignment for keyvault

Question

Big issue with account assignment for keyvault

florent noirot 30

I opened an azure account and wrote a script to create a ressource group, a keyvault and write a secret in it. Very basic stuff but it has turned out into a nightmare

Despite having the proper tenantId, subscriptionID, keyvault ID, I have been unable to do the following action in the script

az role assignment create \
            --role "Key Vault Administrator" \
            --assignee-principal-type User \
            --assignee-object-id "$USER_ID" \
            --scope "$KV_ID" \
            --subscription "$SUBSCRIPTION_ID"

as I get this error

ERROR: (MissingSubscription) The request did not have a subscription or a valid tenant level resource provider.
Code: MissingSubscription
Message: The request did not have a subscription or a valid tenant level resource provider.

So I have looked and looked around...but I havnt been able to find a solution besides the fact that there might be a problem with my account, given that I used a gmail account to create my azure environment. But looking at my account it seems to be a Member account not a guest one, until I saw that it was considered as an external account and saw the button make account internal

So I went through that process, but now I cant login anymore as azure says that I need an external account.....so there in an azure environment with an active subscription running but with none one now being able to access it anymore. This is surprising that Microsoft allows something so egregious to happen

I have no idea what to do to get control again of my azure environment

I would appreciate any help to get control back of the environment and solving this assignment issue

0 comments

2 answers

Your answer

Answer 1

Deleted

This answer has been deleted due to a violation of our Code of Conduct. The answer was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.

Comments have been turned off. Learn more

Answer 2

Hi, it looks like you created the subscription with a Microsoft account (gmail) and are viewing it from the wrong tenant: don't convert that account to "member", leave it as Guest; re-enter the portal by choosing "Sign in with Microsoft account" (not work/school), then use "Directory + subscription" to switch to the tenant containing the subscription; once inside, create a local cloud user (user@<tenant>.onmicrosoft.com), give it Global Administrator in Login ID and Owner or User Access Administrator on the subscription, also keeping your gmail as Guest + Owner; then in CLI do az login --tenant <tenantId> and az account set --subscription <subId> (your MissingSubscription error almost always arises from misaligned tenant/subscription); verify that Microsoft.Authorization is registered and that you have privileges to create assignments; To write secrets, assign "Key Vault Secrets Officer" (scope = vault ID) and use "Key Vault Administrator" only for vault management. Otherwise, if the vault is in "access policy" mode, set an access policy instead of RBAC. If you can no longer log in with Gmail, try logging in with a Microsoft account and changing directories. As a last resort, open a support ticket to restore the Owner status on the subscription.